SC-200 Practice Exam 57 — 20 Questions

Question 1

You are a security analyst at a company that uses Microsoft Sentinel and Microsoft Defender for Identity (now part of Microsoft Defender XDR). During a threat hunt, you need to identify potential golden ticket attacks. You have Windows Security Events (Event ID 4672: Special Logon) and Kerberos service ticket events (Event ID 4769) ingested. A golden ticket attack often involves service ticket requests with unusual encryption types or ticket options. You want to find service ticket requests (4769) that have TicketOptions containing '0x40810000' (forwardable, renewable, canonicalize) and TicketEncryptionType == '0x17' (RC4), which are common in attacks. You need to write a KQL query that returns the top 10 accounts requesting such tickets in the last 7 days. Which query should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_. The correct query filters SecurityEvent for EventID 4769 (Kerberos service ticket request), then applies exact-match conditions on TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" to identify RC4-encrypted, forwardable/renewable/canonicalize tickets typical of golden ticket attacks. It then summarizes counts by AccountName and returns the top 10, matching the requirement precisely.

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4672 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions contains "0x40810000" and TicketEncryptionType contains "0x17" | summarize count() by AccountName | top 10 by count_

Question 2

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to view all processes that initiated outbound network connections to known malicious IPs on a specific device. Which advanced hunting table should the analyst query?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender captures network connection events, including outbound connections to IP addresses, ports, and protocols. To investigate processes that initiated outbound connections to known malicious IPs on a specific device, this table provides the necessary data, such as the initiating process ID, remote IP, and port. The DeviceProcessEvents table only logs process creation events, not network activity, making it unsuitable for this query.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 3

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

Accepted Answer

Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.. Microsoft Sentinel uses automation rules to trigger playbooks (Azure Logic Apps) based on incident creation or update conditions. By associating a playbook that sends an email with an automation rule set to trigger on high-severity incidents, the SOC achieves fully automated, event-driven notification without manual intervention.

Answer

Set an analytics rule to run a KQL query and send email.

Answer

Create a workbook that emails the on-call engineer daily.

Answer

Configure a logic app manually triggered by the analyst.

Question 4

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). You need to configure role-based access control (RBAC) for the security team. Which TWO built-in roles can be assigned in Microsoft 365 Defender to manage incidents and alerts?

Accepted Answer

Security Operator. Security Operator and Security Administrator are the two built-in roles in Microsoft 365 Defender that include permissions to manage incidents and alerts. Security Operator can view and respond to incidents and alerts, while Security Administrator has full access to all security features, including the ability to edit policies and manage incidents. These roles are specifically designed for security operations tasks within Defender XDR.

Answer

Global Administrator

Answer

Compliance Administrator

Answer

Security Reader

Question 5

Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?

Accepted Answer

Use the 'Block' governance action in Defender for Cloud Apps. The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.

Answer

Create a conditional access policy to block the IP

Answer

Add the IP to the blocked IP address range list

Answer

Suspend the user from Microsoft Entra ID

Question 6

Your organization uses Microsoft Sentinel for security operations. The SOC team receives an incident that was generated from a Microsoft Defender for Cloud Apps alert. The incident involves a user who is downloading a large number of files from SharePoint Online. The analyst needs to suspend the user's account immediately to stop the potential data exfiltration. The organization has a Microsoft Sentinel playbook that can suspend a user in Microsoft Entra ID. However, the playbook is not triggering automatically. You need to ensure that the playbook runs automatically whenever a Defender for Cloud Apps alert generates an incident in Sentinel. What should you configure?

Accepted Answer

Create an automation rule that triggers the playbook when an incident is created from Defender for Cloud Apps. An automation rule can be created to trigger a playbook on incident creation, specifically filtering for incidents from Defender for Cloud Apps. This enables automatic execution of the playbook to suspend the user. Option B is incorrect because a scheduled analytics rule is for generating alerts based on queries, not for triggering playbooks on existing incidents. Option C is incorrect because enabling the connector only syncs alerts, but does not automatically run playbooks; an automation rule is required. Option D is incorrect because the playbook's trigger is configured in the automation rule, not by modifying the playbook itself.

Answer

Create a scheduled analytics rule that detects large file downloads

Answer

Enable the Microsoft Defender for Cloud Apps connector to sync alerts

Answer

Modify the playbook to run on alert creation

Question 7

You are using Microsoft Sentinel UEBA to hunt for insider threats. Which entity type would you investigate to detect unusual access to sensitive data?

Accepted Answer

User. Microsoft Sentinel UEBA builds behavior profiles around entity types including User, Host, IP, and Application. To detect insider threats involving unusual access to sensitive data, the User entity is the right focus because UEBA tracks each user's normal data access patterns, peer group comparisons, and anomalies like accessing files or sites they normally do not. Investigating the User entity surfaces deviations such as mass downloads, access outside normal hours, or access to sensitive SharePoint sites.

Answer

IP

Answer

Application

Answer

Device

Question 8

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of an unusual-location sign-in followed immediately by mass SharePoint downloads from a low-privilege account is the classic UEBA signature of credential compromise: an attacker authenticates with stolen credentials and exfiltrates data the account can reach. A low-privilege user has no legitimate business reason to suddenly download large volumes of sensitive files from a new geography, so the behavior deviates sharply from the account's established baseline. Microsoft Sentinel's UEBA correlates the anomalous sign-in with the abnormal data-access activity to surface this as a high-confidence compromise indicator.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 9

A security analyst is reviewing a phishing incident in Microsoft 365 Defender. They need to find all users who received a specific email message by searching for the email's Internet Message ID. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Advanced Hunting stores metadata about email transactions, including the Internet Message ID (a unique identifier defined in RFC 5322). By querying this table with the specific Internet Message ID, the analyst can retrieve all recipients who received that exact email, making it the correct choice for this scenario.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

AADSignInEventsBeta

Question 10

An analyst is investigating a malware incident in Microsoft 365 Defender and has isolated the compromised device using automated investigation and response. The analyst now needs to collect a copy of a suspicious file from that device for further analysis in a sandbox. Which action should the analyst take from the device's entity page?

Accepted Answer

Initiate 'Collect investigation package' action.. The 'Collect investigation package' action is the correct choice because it is specifically designed to gather a comprehensive set of forensic data from a device, including suspicious files, without requiring interactive access. This action automatically collects the file and other relevant artifacts, which can then be submitted to Microsoft 365 Defender's sandbox for analysis. It is a one-click, automated process that aligns with the analyst's need to obtain a copy of the file for further investigation.

Answer

Run a live response session and manually download the file.

Answer

Use the 'Add indicator' to allow the file and then collect.

Answer

Use the 'Device isolation' action to isolate again with different settings.

Question 11

During a threat hunt in Microsoft Defender XDR, you notice repeated failed logon attempts from an IP address that belongs to a known anonymizer service. What is the first action you should take?

Accepted Answer

Initiate an investigation by reviewing the impacted user accounts and endpoints for signs of compromise.. In a threat hunt, the discovery of failed logons from an anonymizer IP is a potential indicator of compromise (IoC) that requires immediate validation. The first action should be to investigate the impacted user accounts and endpoints to determine if any logons succeeded or if there are other signs of malicious activity. This aligns with the incident response process of identification and scoping before taking containment or remediation actions. Blocking or creating rules without understanding the scope could disrupt legitimate activity or miss broader compromise.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create an analytics rule in Microsoft Sentinel to alert on all anonymizer IP addresses.

Answer

Report the IP to the Microsoft Sentinel Threat Intelligence team.

Question 12

Your organization uses Microsoft Sentinel. A security incident is generated by a scheduled analytics rule. You need to automatically assign the incident to the SOC team and set its severity. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific team (e.g., SOC team) and set their severity based on conditions like analytics rule name or incident properties. Unlike playbooks, automation rules are lightweight, run immediately without a Logic Apps connector, and are designed for simple, no-code incident management tasks such as assignment and severity changes.

Answer

An analytics rule

Answer

A workbook

Answer

A playbook

Question 13

During a threat hunt, an analyst discovers that a user's device has been sending large amounts of data to an external IP address associated with a known C2 server. The analyst wants to trace the process responsible for the outbound connections. Which Microsoft Defender for Endpoint advanced hunting table should be queried to find the process that initiated the network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents in Microsoft Defender for Endpoint advanced hunting contains network connection events, including the initiating process, remote IP, port, and protocol. To trace which process initiated outbound connections to a known C2 IP, the analyst must query DeviceNetworkEvents, which correlates network activity with the responsible process. This table is purpose-built for network connection telemetry.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 14

Your Microsoft Sentinel workspace is ingesting logs from multiple sources. You notice that the data ingestion cost is higher than expected. You want to reduce costs without losing security value. Which action should you take?

Accepted Answer

Configure basic logs ingestion for verbose data sources such as firewall logs.. Basic logs are designed for high-volume, verbose data sources (e.g., firewall logs, syslog) that have lower security value. They are stored at a reduced cost and support only summary queries, not full KQL analytics. By routing verbose logs to basic logs, you reduce ingestion costs while retaining the ability to perform threat hunting and incident response on high-value analytics logs.

Answer

Reduce the retention period for all data to 30 days.

Answer

Switch the pricing tier from Capacity Reservations to Pay-as-you-go.

Answer

Disable analytics rules that generate high volume of alerts.

Question 15

A company uses Microsoft Defender for Cloud. They need to continuously assess the compliance of their Azure resources against the CIS benchmark. Which feature should they enable?

Accepted Answer

Regulatory compliance dashboard. Microsoft Defender for Cloud's Regulatory compliance dashboard continuously assesses Azure (and AWS/GCP) resources against built-in standards including CIS, PCI DSS, ISO 27001, and NIST, showing pass/fail per control. Enabling the CIS benchmark in this dashboard gives the continuous compliance assessment the company needs. It is the purpose-built feature for mapping resource configurations to regulatory controls.

Answer

Secure Score

Answer

Azure Policy

Answer

Just-In-Time VM access

Question 16

You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?

Accepted Answer

DeviceEvents. DeviceEvents is the correct table because it captures a broad set of endpoint telemetry including process access events, which is where LSASS handle-opening activity is recorded. When a tool like Mimikatz or a credential-dumping utility opens a handle to lsass.exe with read access, that action surfaces in DeviceEvents with ActionType values such as 'ProcessAccess' and fields identifying the source and target processes. DeviceProcessEvents only records process creation, so it would not show the handle open itself.

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 17

A security analyst is hunting for signs of credential dumping using Microsoft Defender for Endpoint. Which advanced hunting query should the analyst use to detect the use of Mimikatz?

Accepted Answer

DeviceProcessEvents where ProcessCommandLine contains 'mimikatz'. Mimikatz is executed as a process, and its invocation (e.g., 'mimikatz.exe', 'Invoke-Mimikatz', or sekurlsa::logonpasswords) appears in the process command line. Microsoft Defender for Endpoint's DeviceProcessEvents table captures ProcessCommandLine, making it the correct table for detecting execution-based credential dumping. This is the standard hunting pattern for tool-name or command-line-based detection.

Answer

DeviceRegistryEvents where RegistryKey contains 'mimikatz'

Answer

DeviceFileEvents where FileName contains 'mimikatz'

Answer

DeviceNetworkEvents where RemoteIP contains 'mimikatz'

Question 18

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Answer

Assign Azure RBAC roles with a condition on the tag.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.

Answer

Apply an Azure Policy to deny access if the user does not have the tag.

Question 19

Your organization uses Microsoft Sentinel. A new analytics rule is needed to detect brute-force attacks against your Azure SQL databases. The rule should minimize false positives and trigger only when multiple failed logins occur from a single IP address within a short time window. Which THREE components are essential for building this rule?

Accepted Answer

An alert threshold set to trigger when the count exceeds 10 failed attempts in 5 minutes.. Setting an alert threshold to trigger when the count exceeds 10 failed attempts in 5 minutes directly reduces false positives by requiring a meaningful number of failures before alerting. This threshold aligns with common brute-force detection patterns, ensuring the rule only fires when there is a high likelihood of an actual attack rather than occasional user errors.

Answer

A reference to the SQLInsights table for performance data.

Answer

A watchlist containing known malicious IP addresses.

Question 20

An organization uses Microsoft Defender for Cloud Apps to detect anomalous behavior. An alert indicates that a user has signed in from an impossible travel scenario. The SOC analyst confirms the alert is a false positive due to a VPN. What should the analyst do to prevent future false positives for this user?

Accepted Answer

Add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps.. The correct action is to add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps (D). Trusted IP addresses are excluded from impossible travel and other anomalous location detections, so legitimate VPN egress IPs will not trigger false positives. This is a targeted, user-impacting fix that preserves detection for other scenarios. Changing Entra ID location or disabling the rule are not appropriate.

Answer

Change the user's location in Microsoft Entra ID.

Answer

Ignore the alert and continue monitoring.

Answer

Disable the impossible travel detection rule.